ci: fix CI on the Forgejo runner (BoringSSL build deps + unmirrored actions) #144

Merged

vxfemboy merged 3 commits from fix/ci-forgejo-build-deps into main 2026-07-29 00:20:48 +00:00

Conversation 0 Commits 3 Files changed 6 +99 -197

vxfemboy commented 2026-07-28 21:34:33 +00:00

Owner

Copy link

All open PRs are red from CI infrastructure, not their content — a trivial libc patch bump (#122) fails the exact same checks as a major crypto bump (#139). The GitHub→Forgejo migration left the CI unable to build. Local cargo fmt/clippy/build/test are fully green.

Two root causes (from the runner logs), both fixed repo-side:

1. BoringSSL build deps missing on the runner

The runner image catthehacker/ubuntu:act-22.04 ships no cmake and no libclang, both of which boring-sys needs (cmake builds BoringSSL; libclang drives its bindgen). build-test died with cmake … No such file or directory. Added apt-get install cmake clang libclang-dev pkg-config to every job that compiles a boring-linking crate: ci/build-test, coverage, mutants, and integration's netem-comparison / netns-tunnel-test / dpi-undetectability (the latter two had cmake but not libclang).

2. Unmirrored composite actions

Actions resolve from the instance (https://virus.ad/<action>), not github.com. actions/checkout and dtolnay/rust-toolchain are mirrored (clone fine); taiki-e/install-action (shear/coverage/mutants) and EmbarkStudios/cargo-deny-action (deny) are "Not found". Replaced them with direct cargo install <tool> --locked steps.

Only the two mirrored actions remain across all workflows.

Caveats

• cargo install --locked compiles the tools from source (slower CI). Instance-side (per our plan): mirror taiki-e/install-action + bake the build deps into the runner image → restores the fast path and lets these workarounds be dropped.
• Workflows can't be fully tested locally — the runner confirms them. The netns-tunnel-test/dpi jobs also need privileged netns + external tools; if they still fail after this, that's the runner-privilege side (instance-side), not the build.

Merge this first — it unblocks CI for every other open PR. The trivial dep bumps should then go green; the major crypto bumps (ed25519-dalek v3, x25519-dalek v3, boring v5, …) will surface real build failures to migrate individually.

**All open PRs are red from CI infrastructure, not their content** — a trivial `libc` patch bump (#122) fails the exact same checks as a major crypto bump (#139). The GitHub→Forgejo migration left the CI unable to build. Local `cargo fmt`/`clippy`/`build`/`test` are fully green. Two root causes (from the runner logs), both fixed repo-side: ### 1. BoringSSL build deps missing on the runner The runner image `catthehacker/ubuntu:act-22.04` ships **no `cmake` and no `libclang`**, both of which `boring-sys` needs (cmake builds BoringSSL; libclang drives its bindgen). `build-test` died with `cmake … No such file or directory`. Added `apt-get install cmake clang libclang-dev pkg-config` to every job that compiles a boring-linking crate: `ci/build-test`, `coverage`, `mutants`, and integration's `netem-comparison` / `netns-tunnel-test` / `dpi-undetectability` (the latter two had cmake but not libclang). ### 2. Unmirrored composite actions Actions resolve from the instance (`https://virus.ad/<action>`), not github.com. `actions/checkout` and `dtolnay/rust-toolchain` are mirrored (clone fine); **`taiki-e/install-action`** (shear/coverage/mutants) and **`EmbarkStudios/cargo-deny-action`** (deny) are **"Not found"**. Replaced them with direct `cargo install <tool> --locked` steps. Only the two mirrored actions remain across all workflows. ## Caveats - `cargo install --locked` compiles the tools from source (slower CI). Instance-side (per our plan): mirror `taiki-e/install-action` + bake the build deps into the runner image → restores the fast path and lets these workarounds be dropped. - Workflows can't be fully tested locally — the runner confirms them. The `netns-tunnel-test`/`dpi` jobs also need privileged netns + external tools; if they still fail after this, that's the runner-privilege side (instance-side), not the build. **Merge this first** — it unblocks CI for every other open PR. The trivial dep bumps should then go green; the major crypto bumps (ed25519-dalek v3, x25519-dalek v3, boring v5, …) will surface *real* build failures to migrate individually.

vxfemboy added 1 commit 2026-07-28 21:34:33 +00:00

ci: fix CI on the Forgejo runner (BoringSSL build deps + unmirrored actions) ... 762b03233c

All PRs were red after the GitHub->Forgejo migration, from CI infra, not their
content (a trivial libc bump failed identically to a major crypto bump).

Two root causes, both fixed repo-side so CI works on a bare runner:

1. BoringSSL build deps missing. The runner image (catthehacker/ubuntu:act-22.04)
   ships neither cmake nor libclang, both of which `boring-sys` needs (cmake to
   build BoringSSL, libclang for its bindgen). `cargo build --workspace` failed
   with "cmake ... No such file or directory". Added an explicit
   `apt-get install cmake clang libclang-dev pkg-config` step to every job that
   compiles a boring-linking crate: ci build-test, coverage, mutants, and the
   integration netem-comparison / netns-tunnel-test / dpi-undetectability jobs
   (the last two installed cmake but not libclang).

2. Unmirrored composite actions. Actions resolve from the instance
   (https://virus.ad/<action>), not github.com, and only some are mirrored.
   `actions/checkout` and `dtolnay/rust-toolchain` clone fine, but
   `taiki-e/install-action` (shear/coverage/mutants) and
   `EmbarkStudios/cargo-deny-action` (deny) are "Not found". Replaced them with
   direct `cargo install <tool> --locked` steps (+ `cargo deny check`).

`cargo install --locked` builds the tools from source (slower); mirroring
taiki-e/install-action + baking the build deps into the runner image
(instance-side) restores the fast path and can drop these workarounds later.

Only mirrored actions (checkout, rust-toolchain) remain across all workflows.

vxfemboy added 1 commit 2026-07-28 22:00:40 +00:00

ci: skip root-gated netns/netem tests in build-test (Forgejo runs as root) ... e00c6a27c6

After the cmake fix, build-test compiled but `cargo test --workspace` failed:
the Forgejo build-test container runs as ROOT, so the root-gated netns/netem
integration tests (netem_bench.rs, tunnel_netns.rs) no longer skip (as they did
on GitHub's non-root runner) — they try to run and fail on missing netns/`ip`
tooling. These tests have dedicated privileged jobs in integration.yml; they
were always skipped in build-test.

Add a YIP_SKIP_PRIVILEGED_TESTS opt-out to their root gate and set it in the
build-test Test step only. Privileged integration jobs and local `sudo cargo
test` leave it unset and still run the tests. Verified: full workspace test with
the env set is all-green (netns/netem tests skip cleanly).

vxfemboy added 1 commit 2026-07-29 00:20:29 +00:00

Merge branch 'main' into fix/ci-forgejo-build-deps aa6cb98285

vxfemboy merged commit 9ec208d8bb into main 2026-07-29 00:20:48 +00:00

vxfemboy referenced this pull request from a commit 2026-07-29 00:20:48 +00:00

Merge pull request 'ci: fix CI on the Forgejo runner (BoringSSL build deps + unmirrored actions)' (#144) from fix/ci-forgejo-build-deps into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

femboy/yip!144

No description provided.